Website security: what a business owner needs to know
An owner doesn't need to understand the finer points of security — they need to know which questions to ask a contractor and what should be configured by default. Most small and medium business breaches happen not through elaborate attacks but through long-known holes in unpatched components.
The baseline
-
HTTPS across the whole site. The certificate renews automatically, otherwise one day it expires over a weekend.
-
Platform and library updates. Vulnerabilities are published openly — automated scanners find an unpatched site within days.
-
Backups that have been tested by restoring them. A backup that was never restored isn't a backup, it's a hope.
-
Different passwords and two-factor authentication for the admin panel, hosting, domain and email.
-
Rate limiting on admin panel logins.
What most often becomes the way in
-
Outdated plugins and themes, especially free ones abandoned by their authors.
-
Accounts of former staff and contractors who still have access.
-
Forms with no limits on file uploads.
-
Passwords reused across services.
-
Database access exposed externally with no need for it.
Personal data
If the site collects names, phone numbers and emails through forms, that's personal data. The minimum: a privacy policy with explicit consent on submission, storing only what's genuinely needed, limited staff access, and a defined retention period. In Uzbekistan the personal data law applies, including its requirements on where data is stored.
What to ask your contractor
-
How and where backups are made, and how often they're verified by restoring.
-
Who handles updates after handover and whether that's part of support.
-
Who has access to the server and admin panel, and how that access is revoked.
-
What happens in a breach: whether there's a recovery plan and how quickly the site comes back.
Signs the site is already compromised
A sharp rise in traffic from unexpected countries, unfamiliar pages appearing in search for your domain, browser warnings, emails from the host about spam being sent, unexplained changes in files. On any of these, the first step is changing every password, not deleting suspicious files.
If you need the current state of a site checked, or want it maintained with updates and backups, get in touch.